Login Request a demo
High severity · published Jul 17, 2018
CVE-2018-0707
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands
7.2
CVSS
58.8%
EPSS
No
On KEV
Description
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)58.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QC
Q'center · Qnap
through 1.7.1063 · source: NVD
Affected product
QC
Q'center
Qnap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-0707
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-0707
Exploit
http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html
Exploit
http://seclists.org/fulldisclosure/2018/Jul/45
Exploit
https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities
Exploit
https://www.exploit-db.com/exploits/45015/
Third Party Advisory
https://www.exploit-db.com/exploits/45043/
Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/nas-201807-10
More from Q'center
8.8
CVE-2018-0710
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands
8.8
CVE-2018-0709
Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands
8.8
CVE-2018-0708
Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands
8.8
CVE-2018-0706
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information
5.4
CVE-2021-28803
This issue affects: QNAP Systems Inc